Hi
we have gotten alot of proftpd access attempts recently and I have been
trying to extend one of the in-built rules to block IPs after multiple
non-existent user attempts.
Starting with rule 11203, I simply went for a match against rule id and
frequency 3 against the same source IP.
My rule is copied below with rule 11203 and output from ossec-logtest -f
Logtest shows that my rule is tried but no match occurs against it.
thanks
pete
<group name="syslog,proftp,invalid_login">
<rule id="100610" level="10" frequency="3" timeframe="120">
<if_matched_sid>11203</if_matched_sid>
<same_source_ip />
<description>multi proftp non-existent user attempts
BANNED</description>
</rule>
</group>
# <rule id="11203" level="5">
# <if_sid>11200</if_sid>
# <match> no such user </match>
# <description>Attempt to login using a non-existent
user.</description>
# <group>invalid_login,</group>
# </rule>
Apr 21 14:22:58 web.me proftpd[10284] 24.16.255.149
(59.125.51.67[59.125.51.67]): no such user 'Server'
**Phase 1: Completed pre-decoding.
full event: 'Apr 21 14:22:58 web.me proftpd[10284] 24.16.255.149
(59.125.51.67[59.125.51.67]): no such user 'Server''
hostname: 'webme'
program_name: 'proftpd'
log: '24.16.255.149 (59.125.51.67[59.125.51.67]): no such user
'Server''
**Phase 2: Completed decoding.
decoder: 'proftpd'
srcip: '59.125.51.67'
**Rule debugging:
Trying rule: 1 - Generic template for all syslog rules.
*Rule 1 matched.
*Trying child rules.
Trying rule: 5500 - Grouping of the pam_unix rules.
Trying rule: 5700 - SSHD messages grouped.
Trying rule: 5600 - Grouping for the telnetd rules
Trying rule: 2100 - NFS rules grouped.
Trying rule: 2701 - Ignoring procmail messages.
Trying rule: 2800 - Pre-match rule for smartd.
Trying rule: 5100 - Pre-match rule for kernel messages
Trying rule: 5200 - Ignoring hpiod for producing useless logs.
Trying rule: 2830 - Crontab rule group.
Trying rule: 5300 - Initial grouping for su messages.
Trying rule: 5400 - Initial group for sudo messages
Trying rule: 9100 - PPTPD messages grouped
Trying rule: 9200 - Squid syslog messages grouped
Trying rule: 2900 - Dpkg (Debian Package) log.
Trying rule: 7200 - Grouping of the arpwatch rules.
Trying rule: 7300 - Grouping of Symantec AV rules.
Trying rule: 7400 - Grouping of Symantec Web Security rules.
Trying rule: 4300 - Grouping of PIX rules
Trying rule: 12100 - Grouping of the named rules
Trying rule: 13100 - Grouping for the smbd rules.
Trying rule: 11400 - Grouping for the vsftpd rules.
Trying rule: 11300 - Grouping for the pure-ftpd rules.
Trying rule: 11200 - Grouping for the proftpd rules.
*Rule 11200 matched.
*Trying child rules.
Trying rule: 11202 - FTP session closed.
Trying rule: 11221 - IPv6 error and mod-delay info (ignored).
Trying rule: 11209 - Attempt to bypass firewall that can't
adequately keep state of FTP traffic.
Trying rule: 11218 - FTP process crashed.
Trying rule: 11219 - FTP server Buffer overflow attempt.
Trying rule: 11210 - Multiple failed login attempts.
Trying rule: 11203 - Attempt to login using a non-existent user.
*Rule 11203 matched.
*Trying child rules.
Trying rule: 100610 - multi proftp non-existent user attempts BANNED
**Phase 3: Completed filtering (rules).
Rule id: '11203'
Level: '5'
Description: 'Attempt to login using a non-existent user.'
**Alert to be generated.
